The most popular SIEM solutions, developed for many years, such as IBM Security® QRadar® SIEM or Splunk Enterprise Security, were created with the purpose of monitoring IT environments. Despite the extensive knowledge base and support for products of almost all leading manufacturers of network solutions, operating systems and applications, the implementation of these solutions - depending on the complexity of the target environment - takes a specialized team from several weeks to several months.

There are also industries in which the "office" IT environment is not the only IT environment, or even this environment only plays a supporting role for the industrial OT environment. This environment, like the IT environment, must be properly secured in accordance with legal and regulatory requirements. An additional challenge arises here - the SIEM class solutions mentioned do not support OT environments by default. There are no appropriate modules capable of collecting and processing events from solutions such as distributed control systems (DCS), systems supervising the technological or production process (SCADA), or programmable logic controllers (PLC). There are also no appropriate rules to detect attacks on industrial automation environments - and those, officially initiated by Stuxnet (link: https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/) constitute an increasingly numerous group.

This does not mean, however, that SIEM solutions cannot be used to monitor OT environments - on the contrary. OT environments – similarly to IT environments – are IT environments. They consist of networked resources, such as SCADA, DCS or PLC systems, which, like resources operating in IT environments, can report events related to their functioning, which are valuable from the point of view of security, and save them in the form of logs, which are then can be analyzed by a SIEM class solution. In addition to events coming from the OT resources themselves, it is also possible to analyze data sent in OT networks using specialized protocols such as Modbus TCP or PROFIBUS. However, this requires implementing solutions such as Nozomi Networks Guardian or Radiflow iSID and integrating them with a SIEM solution.

Configuring data collection and processing by a SIEM solution is the first stage of implementation. The next stage is to create a set of rules that will allow the SIEM system to recognize signs of incorrect functioning of OT environment solutions, caused by intentional action (attack) or failure. Creating appropriate rules requires excellent knowledge not only of SIEM class solutions, but also of the specificity of the OT environment for the area in which it is located.

Regardless of whether you are just creating a security infrastructure or want to expand it with a SIEM solution - for IT infrastructure, OT or both - Transition Technologies - Systems offers implementation, expansion and optimization services for IBM Security® QRadar solutions ® SIEM and Splunk Enterprise Security.

We believe that our experience in integrating SIEM solutions and knowledge of industrial automation environments - in particular the energy sector - make us an excellent partner in creating an integrated security system for your company.